BIT-rclone-2026-116191: Rclone before 1.75.2 Path Traversal via serve webdav MKCOL
Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/rcloneto a version that resolves this vulnerability.Fixed in 1.75.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Rclone before 1.75.2 with the serve webdav functionality exposed to attackers are affected. The described impact involves writing above the served root and affecting files belonging to other tenants.
Does exploitation require authentication or user interaction?
No. An unauthenticated attacker can exploit the issue remotely, and no user interaction is required.
What can an attacker do after exploiting the traversal?
An attacker can send MKCOL with an unvalidated '..' path component to plant a VFS node above the served root. They can then use PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files outside the intended tenant boundary.
What is the available remediation?
Upgrade Rclone to version 1.75.2 or later. Versions before 1.75.2 are identified as vulnerable.